80 lines
2.2 KiB
Markdown
80 lines
2.2 KiB
Markdown
|
# VLAN 1 — Infrastructure / Default Network
|
|||
|
|
Subnet: **192.168.100.0/24**
|
|||
|
|
|
|||
|
|
Last Updated: 2026-05-21
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🧩 What This Network Is
|
|||
|
|
VLAN 1 is the **primary infrastructure network** for the KingDezigns environment.
|
|||
|
|
It hosts core systems, gateway services, UniFi management, and essential network hardware.
|
|||
|
|
This VLAN is treated as a **semi‑trusted zone**, allowing broad internal communication while still blocking access from lower‑trust networks such as IoT and Lab.
|
|||
|
|
|
|||
|
|
This network remains active during ongoing migration and should not be aggressively restricted until all infrastructure is fully relocated.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 📡 Access Types
|
|||
|
|
- LAN / Cable
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🌐 Subnet
|
|||
|
|
- **192.168.100.0/24**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🖥️ Expected Devices
|
|||
|
|
- Infrastructure devices
|
|||
|
|
- Core services
|
|||
|
|
- UniFi gateway management
|
|||
|
|
- Switches & access points
|
|||
|
|
- Emergency recovery access
|
|||
|
|
- At least one wired management workstation
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🔒 Security Rules for VLAN 1
|
|||
|
|
|
|||
|
|
### **Outbound (VLAN 1 → Others)**
|
|||
|
|
- VLAN 1 can initiate connections to **all internal VLANs**
|
|||
|
|
(VLAN 1, 10, 20, 30, 40, 50).
|
|||
|
|
|
|||
|
|
### **Inbound (Others → VLAN 1)**
|
|||
|
|
- **Allowed:**
|
|||
|
|
- VLAN 20 (Trusted) → VLAN 1
|
|||
|
|
- **Blocked:**
|
|||
|
|
- VLAN 30 (IoT) → VLAN 1
|
|||
|
|
- VLAN 50 (Lab/Servers) → VLAN 1
|
|||
|
|
- **Undefined (depends on default policy):**
|
|||
|
|
- VLAN 40 (Guest) → VLAN 1
|
|||
|
|
|
|||
|
|
### **Net Effect**
|
|||
|
|
- VLAN 1 can reach every internal VLAN.
|
|||
|
|
- Trusted devices may reach VLAN 1.
|
|||
|
|
- IoT and Lab cannot initiate into VLAN 1.
|
|||
|
|
- Guest access depends on global default rules.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## ⚠️ Important Notes
|
|||
|
|
- Infrastructure remains on VLAN 1 during migration.
|
|||
|
|
- Avoid strict firewall enforcement until migration is complete.
|
|||
|
|
- Maintain at least one wired management workstation for safety.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🧠 Summary for AI Systems
|
|||
|
|
- VLAN 1 = **infrastructure + management zone**, semi‑trusted.
|
|||
|
|
- Can initiate connections to all VLANs.
|
|||
|
|
- Trusted VLAN 20 may initiate into VLAN 1.
|
|||
|
|
- IoT VLAN 30 and Lab VLAN 50 are blocked from initiating into VLAN 1.
|
|||
|
|
- Guest VLAN 40 behavior depends on default policy.
|
|||
|
|
- All VLANs may send DNS to Pi‑hole in VLAN 50.
|
|||
|
|
- VLAN 1 is a reachable core network but protected from lower‑trust zones.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# ✔️ End of File
|
|||
|
|
|